Tech Risk and Controls Lead-Vulnerability Management, Network security controls

Job Description

 

Join a role that's central to our technological controls and standards, offering a unique opportunity to shape the firm's tech controls strategy in alignment with various standards and regulatory requirements.

As a Tech Risk and Controls Lead at JPMorganChase within Cybersecurity Technology and Controls, you will lead the enterprise governance and orchestration of the Vulnerability Management function. Serving as the central governance lead and connective layer across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, and line-of-business teams, you will establish clear decision rights, integrate end-to-end oversight, and drive consistent outcomes without displacing technical execution or remediation accountability. The role combines cybersecurity risk and controls expertise with enterprise leadership to strengthen discovery and coverage efficacy, material-change governance, systemic issue management, metrics, regulatory readiness, and continuous improvement across cloud, data center, endpoint, application, container, and other technology environments.

 

Job responsibilities

• Lead the enterprise Vulnerability Management governance function, providing a central coordination point for cross-functional accountability, governance challenge, and escalation
• Establish and maintain the Vulnerability Management governance charter, operating model, decision rights, forums, RACI, materiality thresholds, and escalation pathways
• Orchestrate collaboration across Vulnerability Management Product, Engineering, Operations, Risk Intelligence, Standards and Control Design, control owners, Product Security, and line-of-business teams while preserving clear technical and remediation ownership
• Chair or coordinate enterprise Vulnerability Management governance forums, ensuring working groups prepare complete evidence and decision-making bodies record accountable, timely, and traceable outcomes
• Govern material changes to discovery, coverage, feeds, integrations, scoring, filtering, bundling, exemptions, and inclusion or exclusion rules through documented impact assessment, testing, approval, communication, and post-implementation validation
• Drive systemic root-cause and thematic analysis of vulnerabilities, control failures, recurring defects, data-quality issues, and finding concentrations; translate insights into enterprise corrective actions with clear ownership and tracked closure
• Define and oversee enterprise metrics and reporting that measure discovery and coverage efficacy, control outcomes, governance health, service performance, rule compliance, remediation trends, and downstream impact
• Coordinate enterprise responses to systemic issues and ensure local remediation, exception, and risk-acceptance decisions remain with the appropriate control and business owners
• Partner with the Vulnerability Management Product or Service Owner on strategy, roadmap, prioritization, capability uplift, annual coverage review, and the distinction between routine improvement and material enterprise change
• Coordinate with Audit, Compliance, Operational Risk, and regulatory engagement teams to ensure Vulnerability Management leaders can provide coherent, evidence-based explanations of firmwide scope, methodology, control outcomes, and material decisions
• Promote automation, reusable governance patterns, and auditable workflows that improve the quality, timeliness, and traceability of Vulnerability Management decisions and follow-through

Required qualifications, capabilities, and skills

• Formal training or certification on tech risk and controls concepts and 10+ years applied experience in cybersecurity, technology risk, Vulnerability Management, security engineering, product or service governance, or controls leadership, including experience leading across organizational boundaries
• Demonstrated experience establishing or leading an enterprise Vulnerability Management governance, control tower, service-integration, or comparable cross-functional oversight capability
• Deep understanding of the Vulnerability Management lifecycle, including asset and provider coverage, discovery, scanning, intake, triage, risk rating, routing, remediation, exceptions, validation, reporting, and closure
• Proven ability to define decision rights, governance forums, RACI models, change-control gates, materiality criteria, escalation mechanisms, evidence requirements, and outcome-based metrics
• Experience governing complex Vulnerability Management ecosystems and data flows across multiple tools, providers, platforms, and hybrid technology environments
• Strong analytical capability in discovery and coverage efficacy, systemic root-cause analysis, thematic analysis, control effectiveness, data quality, and enterprise risk reporting
• Executive presence and the ability to challenge constructively, resolve accountability gaps, influence senior stakeholders, and communicate complex technical and risk topics in clear business terms
• Experience supporting Audit, Compliance, Operational Risk, and regulatory engagements, with strong discipline in evidence, decision traceability, issue management, and audit-defensible documentation
• Working knowledge of governance, risk, and compliance platforms, Vulnerability Management technologies, cloud and container security, enterprise data and reporting tools, and automation-enabled control monitoring
• Demonstrated experience using enterprise-authorized AI capabilities to support cybersecurity risk and controls workflows, with rigorous validation, data-sensitivity awareness, and human accountability for decisions

Preferred qualifications, capabilities, and skills

• Professional certifications such as CISSP, CISM, CRISC, GIAC, or relevant cloud security certifications
• Experience operating within large, complex financial services or regulated industry environments with significant regulatory and audit scrutiny
• Familiarity with AI-enabled governance tooling and the application of automation to control monitoring, evidence synthesis, and executive reporting
• Exposure to enterprise risk frameworks, regulatory requirements, and industry standards relevant to Vulnerability Management and cybersecurity controls
• Experience designing or contributing to enterprise-wide communication protocols for governance decisions, systemic issues, and executive-level reporting

 

#CTC

About Us

JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world’s most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management.

We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process. 

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants’ and employees’ religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans

About the Team

Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we’re setting our businesses, clients, customers and employees up for success.